CS Computer and Network Security: Applied Cryptography

Transcription

1 CS Computer and Network Security: Applied Cryptography Professor Kevin Butler Fall 2015

2 Reminders Project Ideas are due on Friday. You should have a good handle on prospective ideas by now. Assignment #2 already posted, due September 18. 2

3 Meet Alice and Bob. Alice and Bob are the canonical players in the cryptographic world. They represent the end points of some interaction Used to illustrate/define a security protocol Other players occasionally join Trent - trusted third party Mallory - malicious entity Eve - eavesdropper Ivan - an issuer (of some object) 3

4 Some notation You will generally see protocols defined in terms of exchanges containing some notation like All players are identified by their first initial E.g., Alice=A, Bob=B d is some data pw A is the password for A k AB is a symmetric key known to A and B KA +,KA - is a public/private key pair for entity A E(k,d) is encryption of data d with key k! H(d) is the hash of data d! Sig(KA -,d) is the signature (using A s private key) of data d! + is used to refer to concatenation 4

5 Some interesting things you want to do when communicating. Ensure the authenticity of a user Ensure the integrity of the data Also called data authenticity Keep data confidential! Guarantee non-repudiation 5

6 Basic (User) Authentication Bob wants to authenticate Alice s identity (is who she says she is) [pw A ] 1 Alice 2 Bob [Y/N] 6

7 Hash User Authentication Bob wants to authenticate Alice s identity (is who she says she is) [h(pw A )] 1 Alice 2 Bob [Y/N] 7

8 Challenge/Response User Authentication Bob wants to authenticate Alice s identity (is who she says she is) [c] Alice 2 [h(c+pw A )] 1 Bob 3 [Y/N] 8

9 User Authentication vs. Data Integrity User authentication proves a property about the communicating parties E.g., I know a password Data integrity ensures that the data transmitted... Can be verified to be from an authenticated user Can be verified to determine whether it has been modified Now, lets talk about the latter, data integrity 9

10 Simple Data Integrity? Alice wants to ensure any modification of the data in flight is detectable by Bob (integrity) Alice 1 [d,h(d)] Bob 10

11 HMAC Integrity Alice wants to ensure any modification of the data in flight is detectable by Bob (integrity) Alice 1 [d,hmac(k,d)] Bob 11

12 Signature Integrity Alice wants to ensure any modification of the data in flight is detectable by Bob (integrity) Alice 1 [d, Sig(KA -, d)] Bob 12

13 Data Integrity vs. Non-repudiation If the integrity of the data is preserved, is it provably from that source? Hash integrity says what about nonrepudiation? Signature integrity says what about nonrepudiation? 13

14 Confidentiality! Alice wants to ensure that the data is not exposed to anyone except the intended recipient (confidentiality) [E(k AB,d), HMAC(kAB, d)] Alice 1 Bob 14

15 Question If I already have an authenticated channel (e.g., the remote party s public key), why don t I simply make up a key and send it to them? 15

16 Confidentiality! Alice wants to ensure that the data is not exposed to anyone except the intended recipient (confidentiality)!! But, Alice and Bob have never met!!!!!!!!! Alice [E(k x,d), hmac(kx, d),e(kb +,k x )] 1 Bob!!!! Alice randomly selects key k x to encrypt with! 16

17 Real Systems Security The reality of the security is that 90% of the frequently used protocols use some variant of these constructs. So, get to know them they are your friends We will see them (and a few more) over the term They also apply to systems construction Protocols need not necessarily be online Think about how you would use these constructs to secure files on a disk drive (integrity, authenticity, confidentiality) We will add some other tools, but these are the basics 17

18 Key Distribution/Agreement Key Distribution is the process where we assign and transfer keys to a participant Out of band (e.g., passwords, simple) During authentication (e.g., Kerberos) As part of communication (e.g., skip-encryption) Key Agreement is the process whereby two parties negotiate a key 2 or more participants Typically, key distribution/agreement this occurs in conjunction with or after authentication. However, many applications can pre-load keys 18

19 Key Distribution Say we used pairwise key distribution/ agreement in this class (strictly symmetric cryptography)! Q: how many key negotiations would there be?! ASes in the Internet: how many negotiations for secure routing solutions? 19

20 Diffie-Hellman Key Agreement The DH paper really started the modern age of cryptography, and indirectly the security community Negotiate a secret over an insecure media E.g., in the clear (seems impossible) Idea: participants exchange intractable puzzles that can be solved easily with additional information. Mathematics are very deep Working in multiplicative group G Use the hardness of computing discrete logarithms in finite field to make secure Things like RSA are variants that exploit similar properties 20

21 Definitions (Num. Theory) Field: set of numbers closed under addition and multiplication (also associative and commutative) Finite Field: field with finite elements: a set of numbers modulo p Multiplicative Group modulo p: finite field plus multiplication operation (numbers 1,... p-1) Subgroup: some elements of a group: if group operation applied, element still in subgroup e.g., additive group mod 8, set {0, 2, 4, 6} forms subgroup 21

22 Diffie-Hellman Protocol For two participants p 1 and p 2 Setup: We pick a prime number p and a base g (<p) This information is public E.g., p=23, g=5! Step 1: Each principal picks a private value x (<p-1) Step 2: Each principal generates and communicates a new value y = g x mod p! Step 3: Each principal generates the secret shared key z! z = y x mod p! Perform a neighbor exchange. 22

23 Diffie-Hellman Params: p=23, g=5 (public values) Alice Bob Private: x Private: x Y = 5 = 8 Y = 5 = 19 Z = Y = 19 = 2 Z = Y = 8 = 2 23

24 Attacks on Diffie-Hellman This is key agreement, not authentication. You really don t know anything about who you have exchanged keys with The man in the middle!!! A B Alice and Bob think they are talking directly to each other, but Mallory is actually performing two separate exchanges You need to have an authenticated DH exchange e.g., out of band 24

25 D-H Subtleties Generator: g i generates elements in group Primitive element: there is some i such that g generates all elements in a group Weakness: if g is not a primitive element of the group then only a small subgroup may be generated Solution: safe primes prime p of form 2q +1 where q prime subgroups now {1}, {1, p-1}, size q, size 2q 2, 5 are good values for generators 25

26 Public Key Cryptography Each key pair consists of a public and private component: k + (public key), k - (private key) D(E(p, k + ),k )=p D(E(p, k ),k + )=p Public keys are distributed (typically) through public key certificates Anyone can communicate secretly with you if they have your certificate E.g., SSL-based web commerce 26

27 RSA (Rivest, Shamir, Adelman) A dominant public key algorithm The algorithm itself is conceptually simple Why it is secure is very deep (number theory) Use properties of exponentiation modulo a product of large primes "A method for obtaining Digital Signatures and Public Key Cryptosystems, Communications of the ACM, Feb., (2) pages

28 RSA Key Generation Pick two large primes p and q Calculate n = pq Pick e such that it is relatively prime to phi(n) = (q-1)(p-1) Euler s Totient Function d -1 = e (mod phi(n)) de mod phi(n) = 1 or 1. p=3, q=11! 2. n = 3*11 = phi(n) = (2*10) = e = 7 GCD(20,7) = 1! 5. Euclid s Algorithm d -1 = e (mod phi(n)) 1 = 7d mod 20 d = 3 28

29 RSA Encryption/Decryption Public key k + is {e,n} and private key k - is {d,n} Encryption and Decryption E(k+,P) : ciphertext = plaintext e mod n D(k-,C) : plaintext = ciphertext d mod n Example Public key (7,33), Private Key (3,33) Data 4 (encoding of actual data)! E({7,33},4) = 47 mod 33 = mod 33 = 16 D({3,33},16) = 163 mod 33 = 4096 mod 33 = 4 29

30 Encryption using private key Encryption and Decryption E(k -,P) : ciphertext = plaintext d mod n D(k +,C) : plaintext = ciphertext e mod n E.g.,! E({3,45},4) = 43 mod 33 = 64 mod 33 = 31 D({7,45},19) = 317 mod 33 = 27,512,614,111 mod 33 = 4! Q: Why encrypt with private key? 30

31 Digital Signatures Models physical signatures in digital world Association between private key and document and indirectly identity and document. Asserts that document is authentic and non-reputable To sign a document Given document d, private key k- Signature S(d) = E( k -, h(d) ) Validation Given document d, signature S(d), public key k+ Validate D(k +, S(d)) = H(d) 31

32 Cryptanalysis and Protocol Analysis Cryptographic Algorithms Complex mathematical concepts May be flawed What approaches are used to prove correct/find flaws?! Cryptographic Protocols Complex composition of algorithms and messages May be flawed What approaches are used to prove correct/find flaws? 32

33 Attacks Against RSA Mathematical approaches include: factor n = pq determine the totient find private key d directly All equivalent to factoring n But: factoring large numbers is hard 33

34 Cryptanalysis of RSA Security Premise Factoring Large Integers is Hard N=pq; N is known, can we find p, q Some Known (to cryptanalyst) If (p-1) is product of prime factors less than B N can be factored in time less than B3 Best Known Approach: General Number Field Sieve Significant early application by Arjen Lenstra German Federal Agency for Information Technology Security Factor 663-bit number Took several months using 80 AMD Apteron CPUs 34

35 Textbook RSA Safe to use? NO!! Multiplicative homomorphism For c = E(m) = m e mod(n) E(m1) * E(m2) = E(m1 * m2) Avoid structure by encoding values with PKCS#1 Use different exponents for encryption and signing (typically e=3 for enc., 5 for signing) don t use small d, insecure (small exponent attack) 35

36 Misuse of RSA Common Modulus Misuse Use the same N for all users Since all have a private key for same N Anyone can factor Blinding Misuse Suppose adversary wants you to sign an arbitrary message M You don t sign Adversary generates innocent M Where M = r e M mod N Adversary can generate signature of M from M s signature Only use RSA (or any algorithm) in standard ways 36

37 RSA Exponent Problems Small Private Exponent Speeds decryption time However, Known Attacks Exist on Small Private Keys Due to Mike Wiener, can recover private key Result: If N is 1024 bits, d of private key must be at least 256 bits Some workarounds are known (e.g., based on Chinese Remainder Theorem), but not proven secure Small Public Exponent Speed signature verification time Smallest possible value is 3, but recommend Can recover M encrypted with multiple, small public keys Can recover private key from small public + bits of private 37

38 Common Modulus Attack Alice uses n, ea Bob uses n, eb (i.e., share common modulus) If ea and eb are relatively prime then eavesdropper Eve does the following:!! c a = m e a mod n c b = m e b mod n Use Euclidean algorithm to find r,s where ea*r + eb*s = 1 (the e values are public) Now: (m e a mod n) r (m e b mod n) s = M e a r+e b s = M mod n mod n 38

39 More Info on RSA Attacks D. Boneh, 20 Years of Attacks on the RSA Cryptosystem, abstracts/rsaattack-survey.html Results Fascinating attacks have been developed None devastating to RSA Cautions Improper use Secure implementation is non-trivial 39

40 Timing Attacks Use the timing behavior of system to extract secret Suppose a smartcard stores your private key By precisely measuring the time it takes to perform private key ops, we can recover the key Due to Kocher At most 2n operations required, where n is the number of bits in the key Attack summary Adversary asks smartcard to generate signatures on several messages Recover one bit at a time starting with least significant Compare times to those measured offline Solution: blinding 40

41 Power Analysis Attacks Also, Discovered by Kocher Power usage is higher than normal in these computations Measure the timing of high power consumption Simple Power Analysis Direct interpretation of power measurements Reveals instructions executions Some crypto ops may be sensitive to data, e.g., DES S- boxes Differential Power Analysis Statistical analysis of power data correlations Solution: Must change the code! 41

42 Power and Timing What is the threat model in power/timing attacks? How does this conflict with the trust model? What is the vulnerability? 42

43 A Protocol Story Needham-Schroeder Public Key Authentication Protocol Defined in 1978 Assumed Correct Many years without a flaw being discovered Proven Correct BAN Logic So, It s Correct, Right? 43

44 Needham-Schroeder Public Key Protocol in detail:! Nonce Message a.1: A B : A,B, {N A, A} PKB A initiates protocol with fresh value for B Message a.2: B A : B,A, {N A, N B } PKA B demonstrates knowledge of N A and challenges A Message a.3: A B : A,B, {N B } PKB A demonstrates knowledge of N B! A and B are the only ones who can read N A and N B 44

45 Gavin Lowe Attack An active intruder X participates... Message a.1: A X : A,X, {N A, A} PKX Message b.1: X(A) B : A,B, {N A, A} PKB X as A initiates protocol with fresh value for B Message b.2: B X(A) : B,A, {N A, N B } PKA Message a.2: X A : X,A, {N A, N B } PKA X asks A to demonstrates knowledge of N B Message a.3: A X : A,X, {N B } PKX A tells X N B; thanks A! Message b.3: X(A) B : A,B, {N B } PKB X completes the protocol as A 45

46 What Happened? X can get A to act as an oracle for nonces Hey A, what s the N B in this message from any B? A assumes that any message encrypted for it is legit Bad idea X can enable multiple protocol executions to be interleaved Should be part of the threat model? 46

47 The Fix It s Trivial (find it) Message a.1: A --> B : A,B, {N A, A} PKB A initiates protocol with fresh value for B Message a.2: B --> A : B,A, {N A, N B, B} PKA B demonstrates knowledge of N A and challenges A Message a.3: A --> B : A,B, {N B } PKB A demonstrates knowledge of N B 47

48 Impact on Protocol Analysis Protocol Analysis Took a Black Eye BAN Logic Is Insufficient BAN Logic Is Misleading Protocol Analysis Became a Hot Topic Lowe s FDR Meadow s NRL Analyzer Millen s Interrogator Rubin s Non-monotonic protocols In the end, could find known flaws, but... attacker model is too complex 48

49 Dolev-Yao Result Strong attacker model Attacker intercepts every message Attacker can cause one of a set of operators to be applied at any time Operators for modifying, generating any kind of message Attacker can apply any operator except other s decryption Theoretical Results Polynomial Time for One Session Undecidable for Multiple Sessions Moral: Analysis is Difficult Because Attacker Can Exploit Interactions of Multiple Sessions End Result: Manual Induction and Expert Analysis are the main approaches 49

50 Review: secret vs. public key crypto Secret key cryptography Symmetric keys, where A single key (k) is used is used for E and D D( E( p, k ), k ) = p All (intended) receivers have access to key Note: Management of keys determines who has access to encrypted data E.g., password encrypted Also known as symmetric key cryptography Public key cryptography Each key pair consists of a public and private component: k+ (public key), k- (private key) D( E(p, k+), k- ) = p D( E(p, k-), k+ ) = p Public keys are distributed (typically) through public key certificates Anyone can communicate secretly with you if they have your certificate E.g., SSL-based web commerce 50

51 The symmetric/asymmetric key tradeoff Symmetric (shared) key systems Efficient (Many MB/sec throughput) Difficult key management Kerberos Key agreement protocols Asymmetric (public) key systems Slow algorithms (so far ) Easy (easier) key management PKI - public key infrastructures Webs of trust (PGP) 51

52 Basic truths of cryptography Cryptography is not frequently the source of security problems Algorithms are well known and widely studied Use of crypto commonly is (e.g., WEP) Vetted through crypto community Avoid any proprietary encryption Claims of new technology or perfect security are almost assuredly snake oil 52

53 Crypto... the end? This marks the end of our coverage of cryptographic building blocks for the semester. There are open problems in crypto (e.g., quantumresistant systems) However, we have plenty of basic constructions to help us build secure systems. You will see crypto pop up throughout the semester, but those with more interest should take the crypto course here at UF. 53